CVE-2023-6020 Ray Static File Local File Include

🗓️ 16 Nov 2023 21:07:33Reported by @huntr_aiType

CVE-2023-6020 Ray Static File Local File Include vulnerability allows unauthenticated attackers to read any file on the server

Reporter	Title	Published	Views	Family All 34
BDU FSTEC	The vulnerability of the AI application scaling framework and Python Ray, related to an incorrect path name limitation for the restricted access catalog, allows attackers to read arbitrary files.	3 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the dashboard component of the application scaling framework for AI and Python Ray applications, which allows a hacker to execute arbitrary commands.	3 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the AI application scaling framework and Python Ray, related to deficiencies in the authentication process, allows attackers to read arbitrary files from the /static/ directory.	3 Apr 202400:00	–	bdu_fstec
Circl	CVE-2023-6020	25 Nov 202312:14	–	circl
CNNVD	Ray Security breach	16 Nov 202300:00	–	cnnvd
CVE	CVE-2023-6020	16 Nov 202321:07	–	cve
Github Security Blog	Ray Path Traversal vulnerability	16 Nov 202318:30	–	github
Github Security Blog	Ray Missing Authorization vulnerability	16 Nov 202321:30	–	github
Metasploit	Ray static arbitrary file read	23 Aug 202418:52	–	metasploit
Nuclei	Ray Static File - Local File Inclusion	13 Jun 202613:20	–	nuclei

[
  {
    "vendor": "ray-project",
    "product": "ray-project/ray",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6

08 Feb 2024 09:47Current

8.6High risk

Vulners AI Score8.6

CVSS 37.5

EPSS0.81449

CWE-862